diff --git a/metropolis/node/kubernetes/pki/kubernetes.go b/metropolis/node/kubernetes/pki/kubernetes.go
index ead8897..962e70d 100644
--- a/metropolis/node/kubernetes/pki/kubernetes.go
+++ b/metropolis/node/kubernetes/pki/kubernetes.go
@@ -139,7 +139,7 @@
 			"metropolis-kube-apiserver",
 		},
 		// TODO(q3k): add service network internal apiserver address
-		[]net.IP{{10, 0, 255, 1}, {127, 0, 0, 1}},
+		[]net.IP{{10, 224, 0, 1}, {127, 0, 0, 1}},
 	))
 	make(IdCA, APIServerKubeletClient, opki.Client("metropolis:apiserver-kubelet-client", nil))
 	make(IdCA, ControllerManagerClient, opki.Client("system:kube-controller-manager", nil))